The Agent Access Model
- Source
- blog.cloudflare.com
- Author
- Matt Silverlock
- Date
Context
Cloudflare's proposed Agent Access Model would reduce what an can do as it encounters sensitive information. A task begins with a fixed permission ceiling. A mechanism called the Trust Ratchet can then remove capabilities, such as external destinations, before protected data reaches the model.
The design requires every relevant enforcement component to acknowledge the restriction before releasing that data. Removed permissions cannot be restored within the active task. This aims to prevent an agent from reading confidential material and then sending it through a previously available channel. It is a reference architecture whose protection depends on tool and network traffic being unable to bypass enforcement.
- The model's one rule is 'do not trust the run.' Authorization for one action never carries to the next: every action is judged against who the agent is, which task it was authorized for, and which sensitive resources the run has already touched.
- That last input is one-way. The Trust Ratchet only removes capability — once a run reads something protected, it permanently loses matching powers, and it gets them back only in a freshly authorized task. Not a policy check, a state machine.
- The strategic inversion: most work tries to make each access decision smarter. This makes the agent's capability smaller so there is less to judge. Shrinking the blast radius scales better than growing the judge.
- A prompt is not a perimeter. 'Never touch production' shapes behavior but enforces nothing, since injected content in whatever the agent reads can steer it. Enforcement has to live in the that mediates tool calls and the network that mediates packets.
- A practical gap in today's standards: DPoP (RFC 9449) binds a to a key but its proof covers only the HTTP method and target URL — not the body, query string, or tool arguments. So the harness must authorize an immutable request and then execute that exact request.
- AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
- agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
- token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
“The controls we built for humans do not fail loudly when we point them at agents. They fail quietly, by granting too much, seeing too little, and trusting for too long.”
“A boundary you can talk your way past is not a boundary.”
“An agent that has read a system of record while retaining an outbound path can exfiltrate data at machine speed.”
“The lifetime of the credential should match the lifetime of the task. For an agent, that is often minutes.”
“An approval that is always granted is not a control. It is a ritual that trains people to ignore the one prompt that matters.”
Checking sign-in…
Loading comments…